1. Scope and accountability
This Privacy Policy applies to personal information handled by EnodoHealth through enodohealth.com, enodoCare, enodoAlly, account and support services, transactional communications, product trials, and related services. A separate customer agreement, clinic notice, or consent may provide additional terms for a particular service.
EnodoHealth is responsible for personal information under its control. Our Privacy Officer receives privacy questions, complaints, and requests at support@enodohealth.com. When a clinic or clinician determines why and how patient information is used for care, that organization or professional remains responsible for its own privacy obligations and EnodoHealth handles the information as its service provider or agent, as applicable.
2. Information we collect
We collect information you provide, including account and profile details; contact and professional information; messages sent through contact, support, intake, and care workflows; appointment, assessment, task, journal, check-in, and clinician-entered information; consent records; and billing, transaction, and receipt information. Public contact forms currently request name, work email, practice type, contact reason, product interest, and an optional message.
We also collect limited technical and usage information needed to operate and protect the Services, such as IP address, device and browser information, authentication and audit events, timestamps, pages or features used, diagnostics, and security events. On eligible public marketing pages, Microsoft Clarity may collect session and navigation analytics only after you make an explicit analytics choice through the privacy banner; Clarity is not enabled on contact, booking, pricing or payment, legal, account, clinician, or patient surfaces. Payment card details are collected by the payment processor and are not entered into or stored directly by EnodoHealth. Information may come from you, your clinic or clinician, authorized organization users, integrated services you connect, payment and communication providers, and the devices you use.
3. Why we use information
We use personal information to create and secure accounts; provide scheduling, practice-management, patient-engagement, assessment, task, journal, reporting, communication, and billing functions; authenticate users; process requests and payments; provide support; send service notices; maintain records; prevent abuse and fraud; investigate incidents; monitor reliability; comply with law; and enforce agreements.
We use contact-form information to respond to the request and manage the resulting business relationship. We do not make optional marketing a condition of receiving the Services. Commercial electronic messages include the sender and an unsubscribe method when required by law. We do not sell personal information.
4. Health information and the roles of care providers
Patient information may include sensitive personal health information. Clinics and clinicians are responsible for determining what information they are authorized to collect and use for care, obtaining required clinical and privacy consents, configuring authorized staff access, and responding to care-related record requests where they control the record.
enodoAlly is designed so raw private journal or chat content is not shown to clinicians by default. The Services may create structured check-ins, trends, limited summaries, or other derived signals for an authorized workflow. A patient-facing confirmation identifies when a limited summary or optional note will be shared. Legal process, security response, or another exception permitted by law may require different handling.
5. AI-assisted processing
Some features use automated or AI-assisted processing to generate drafts, summaries, themes, reminders, or other support outputs. We process only the information needed for the selected function and may use contracted AI infrastructure providers to perform that processing. AI outputs can be incomplete or inaccurate and are not a diagnosis, treatment decision, emergency assessment, or substitute for professional judgment.
AI inference for Canadian customer workloads is performed in Canada. This Canadian inference commitment applies to the AI processing described here; other service categories and exceptional lawful processing may have different locations as explained below.
We do not use identifiable patient content to train a general-purpose model for unrelated purposes unless we first provide a separate clear explanation and obtain any consent required by law. Materially new AI uses or disclosures require privacy review and notice or consent before they begin.
7. Processing locations
EnodoHealth is based in Quebec, Canada. EnodoHealth and its service providers may store or process information in Canada or other countries. Information processed in another jurisdiction may be subject to that jurisdiction's laws and lawful access processes.
We assess service providers and use contractual, organizational, and technical measures appropriate to the sensitivity of the information. Customer-specific commitments about hosting location or data residency apply only when stated in a signed agreement.
8. Retention and deletion
We retain personal information only for as long as reasonably necessary for the identified purposes, legal and professional record requirements, security, dispute resolution, and enforcement. Retention varies by record type and the instructions or obligations of the clinic that controls a patient record.
Raw chat messages are scheduled for deletion after 90 days under the current product policy. Starting patient account deletion ends access immediately and begins a seven-day pending-deletion period during which signing in can restore the account. After that period, EnodoHealth deletes or de-identifies information under its control unless a legal, financial, security, backup, or clinic-record obligation requires limited retention. Payment, consent, audit, and transaction records may be kept longer where required to establish or defend legal rights or meet statutory obligations.
9. Your privacy choices and rights
Subject to applicable law and identity verification, you may ask to access personal information under EnodoHealth's control, understand how it has been used or disclosed, correct inaccurate information, withdraw consent, request deletion, or raise a concern. Withdrawing consent does not affect prior lawful handling and may prevent us from providing a feature that needs the information.
If a clinic or clinician controls the requested care record, we may direct the request to that organization or assist it in responding. You may also complain to the Office of the Privacy Commissioner of Canada, the Commission d'accès à l'information du Québec, the Information and Privacy Commissioner of Ontario, or another regulator with jurisdiction.
10. Safeguards and incidents
We use administrative, technical, and organizational safeguards intended to protect information according to its sensitivity, including access controls, authentication, encryption in transit, protected credentials, audit records, and security monitoring. No system eliminates every risk, and users must protect their credentials and devices.
We investigate suspected privacy and security incidents, limit further exposure where possible, preserve necessary evidence, and provide notices to affected people and regulators when required by law.
11. Adults only
The Services are currently intended for people who are at least 18 years old. We do not knowingly offer individual patient accounts to minors. If you believe a minor has provided personal information directly to EnodoHealth, contact the Privacy Officer.
12. Changes to this Policy
We may update this Policy to reflect changes in law, technology, or our Services. We will post the new version and effective date and provide additional notice when appropriate. We will obtain fresh consent before a significant new collection, use, or disclosure where applicable law requires it. Typographical, formatting, and clarification changes do not require renewed consent.
13. Contact the Privacy Officer
Privacy Officer, EnodoHealth Inc., Montreal, Quebec, Canada. Email: support@enodohealth.com. Because EnodoHealth does not publish a physical office address, privacy and legal notices should be sent by email. We may request information needed to verify identity and authority before completing a request.